dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 06:26

Target

dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll
Size

103KB
MD5

81694b2bb15b5af53bca37e790fe756f
SHA1

3f581d795994707295ed2dc9270ff2c28d61acb7
SHA256

dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87
SHA512

1020f4126fa268f2a28b7c8c6e50595c5fa924cd35edefad60b384a359a9c3522598ffb3f7b7366d866827fdaae768306f7bfdb5d5c6de87e93f13b1306fc223
SSDEEP

3072:xyZLYm4WuyTckIW9sxsNTNE1+eRZm/KyZP:ILYsuyTc/W9sQE1Je/Jt

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2108-133-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
732	2108	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2108	4972	rundll32.exe	84
PID 4972 wrote to memory of 2108	4972	rundll32.exe	84
PID 4972 wrote to memory of 2108	4972	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll,#1
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 588
    3⤵
    - Program crash
    PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2108 -ip 2108
1⤵
PID:1284

memory/2108-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download